Use bind parameters in dbTagList query

www/viewgame

@@ -2733,27 +2733,29 @@ import {initTagTable} from './viewgame.js';
 
 var dbTagList = [
 <?php
-        $isMine = ($curuser
-                   ? "sum(userid = '$curuser' and gameid = '$qid')"
-                   : "0");
-        $result = mysql_query(
+        if ($curuser) {
+            $isMine = "sum(userid = ? and gameid = ?)";
+            $isMineParams = [$curuser, $id];
+        } else {
+            $isMine = "0";
+            $isMineParams = [];
+        }
+        $result = mysqli_execute_query($db,
             "select
                tag,
-               sum(gameid = '$qid') as tagcnt,
+               sum(gameid = ?) as tagcnt,
                count(distinct gameid) as gamecnt,
                $isMine as isMine
              from gametags
-             where tag in (select tag from gametags where gameid = '$qid')
+             where tag in (select tag from gametags where gameid = ?)
              group by tag
-             order by tag", $db);
-        $cnt = mysql_num_rows($result);
+             order by tag", [$id, ...$isMineParams, $id]);
 
-        for ($i = 0 ; $i < $cnt ; $i++) {
-            list($tag, $tagcnt, $gamecnt, $isMine) = mysql_fetch_row($result);
+        while ($row = mysql_fetch_row($result)) {
+            [$tag, $tagcnt, $gamecnt, $isMine] = $row;
             $tag = jsSpecialChars($tag);
-            echo ($i > 0 ? "," : "")
-                . "{tag: \"$tag\", tagcnt: $tagcnt, "
-                . "gamecnt: $gamecnt, isMine: $isMine}";
+            echo "{tag: \"$tag\", tagcnt: $tagcnt, "
+               . "gamecnt: $gamecnt, isMine: $isMine},";
         }
 ?>
 ];